[qt314wink]

Purpose

Follow-up hardening for the merged Automation v2 control plane before any repository uses OPENAI_API_KEY.

Fixes

• disable persisted checkout credentials for both caller and control-plane checkouts
• canonicalize evidence-path and require it to resolve inside the caller checkout
• explicitly forbid evidence reads from .git
• expand credential detection/redaction for GitHub token families and x-access-token
• make Responses API text extraction tolerant of valid output item shapes and string / { value } text forms
• expand the documentation JSON Schema so findings/opportunities match the runtime contract
• add regression assertions to Control Plane QA

Authority / safety

This PR does not invoke the OpenAI API, deploy, merge, publish, spend, or modify product repositories. Keep it draft until QA and human review are complete.

Promotion gate

Only after this hardening is reviewed should a canary caller pin the reusable workflow to the immutable corrected commit SHA and exercise the newly-added organization secret.